The public resources of an organization are the most visible from the outside and represent its visible face to customers and suppliers. For this very reason they are the resources most exposed to attack by intruders and therefore the most vulnerable.
The penetration test designed by specialists of S2 Grupo aims to simulate the activity of an alleged attacker who wants to take positions in the resources of the organization. Therefore, the intrusion team will perform the necessary technical tests, from locations outside the customer premises, to verify the safety of the public resources of the organization. The sub-phases of this stage are:
- Test visibility and perimeter security. The intrusion team from S2 Grupo will carry out an inventory of the services publicly accessible on the Internet, in order to determine what would be the main gateways that an intruder would value when attempting an attack against corporate resources within the proposed range. Among the tests to be performed, the intrusion team will verify the correct implementation of access controls at network level (Firewalls and Routers) in order to verify whether a potential intruder would be able to evade the restrictions imposed by these controls and gain more visibility on corporate resources that should be possible from the Internet or external networks beforehand.
- Penetration test. Once obtained the inventory of visible resources from the outside, the intrusion team will conduct a vulnerability audit that will aim to detect deficiencies in design, implementation or deployment that could allow an attacker to gain unauthorized access privileges, and even get full control over the attacked systems.
- Test propagation. Once the vulnerabilities on the visible systems from the Internet have been found and exploited, the intrusion team from S2 Grupo, depending on the possibilities to allow the exploited vulnerability, will try to make a spread to other systems or services, though they were not publicly accessible from the Internet, they do become so after having exploited vulnerabilities in public systems, which would allow an intruder access to systems not previously exposed. This test allows the organization to know the degree of actual risk after each detected vulnerability, and therefore can plan the vulnerability remediation taking into account the real impact its exploitation would have, not just the limited impact of the machine itself that presents the vulnerability.
Logical Security Audit
Depending on the protection objective S2 Grupo designs security audits, focusing on the logical level of protection.
A logical security audit focuses on auditing technical aspects of ICT infrastructure contemplating aspects of architectural design from a security point of view, as well as aspects related to the protection mechanisms deployed to address all kinds of logical incidents.
A logical security audit, therefore, includes the work done by the ethical hacking team from S2 Grupo and develops in its field a test of both external and internal penetration.
Perimeter security audits are thus designed when the TOE (target of evaluation) is the perimeter of the organization. White box or black box audits are designed according to the visibility of the penetration team from S2 Grupo, and even security audits.